Node.js: Symlinks, Signatures, and the Virtual File System Cleanup
A cluster of fixes this cycle tightens up correctness around symbolic links and function signature handling, while version 22.23.2 moves toward release with a security-relevant root certificate update.
Duration: PT2M35S
Episode overview
This episode is a short developer briefing from Node.js.
It explains recent repository work in plain language.
- Show: Node.js
- Published: 2026-07-18T13:04:53Z
- Audio duration: PT2M35S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
This is Node.js, your developer briefing for July 18th, 2026.
The clearest pattern today is a push toward fixing operations that quietly did the wrong thing when symbolic links were involved. Trivikram Kamat landed PR 64350, making lchmod update a symlink's own mode instead of following it to the target file. The same author has now opened PR 64573 to apply identical logic to…
A second theme: evaluation happening more than once, with real consequences. PR 64559 from the same contributor fixes an FFI bug where function signatures were parsed natively, then re-read by the JavaScript wrapper — meaning accessors or mutations could desync the two, silently corrupting calls with mismatched…
On the release side, PR 64567 is the proposal for version 22.23.2, the Jod LTS line. The headline item is a root certificate update to NSS 3.123.1, plus a fix from Ruben Bridgewater for stale memo entries in assert and util's cycle detection. Also worth flagging: PR 64566 addresses a regression where a previously…
Smaller but notable: the stale bot timeout is dropping from 210 days to 90, per PR 64569, which means older open PRs and issues will close faster starting soon. And legendecas opened PR 64565…
W…
Nearby episodes from Node.js
- Edge Case Cleanup Across Core Modules
- Zlib Validation Sweep and REPL Gets an Upgrade
- Weekly Recap - Streams Get Faster, REPL Gets Smarter
- Streams Get a Correctness Sweep
- Memory Safety Sweep Ahead of the Jod LTS Cutoff
- Streams Get a Correctness and Speed Pass
- HTTP Response Handling Gets a Do-Over
- Chasing Down Memory Leaks Across the Stack